Node.js Brotli Decoder Flaw Allows Remote Code Execution in All Supported Versions (CVE-2026-111497)

Scope: Node.js 22.x prior to 22.23.4, 24.x prior to 24.22.1, and 26.x prior to 26.12.1; all end-of-life versions (20.x and earlier) are also exposed and will not be patched

Severity: Red

Node.js released security updates on October 21 for its 22.x, 24.x and 26.x release lines, fixing 10 flaws, the most serious of which is a bug in the bundled Brotli decompression code that the project says can allow remote code execution. The flaw, tracked as CVE-2026-111497, is an out-of-bounds write in the Brotli decoder, set off by malformed compressed input. An application is exposed where it decompresses Brotli data an attacker controls, such as a request body or a response fetched from another server, and the vulnerable code also runs automatically when an application calls fetch() on a response sent with Brotli compression, so a developer does not need to call Brotli directly to be affected. A public proof-of-concept published on October 22 reached code execution only against a deliberately weakened test build; on a standard build, its author reported a crash and a limited read of process memory, and no exploitation in the wild had been reported as of October 22. Exploit development is likely to continue now that a public PoC exists. The same release fixes three other high-severity flaws: two TLS certificate hostname-check bypasses and a dns.resolve flaw that truncates hostnames at an embedded null byte. The updates also block eight intermediate CA keys from the Indian provider eMudhra that were reported compromised days earlier, and remove three emSign roots from the bundled root list. Given how widely Node.js is used across Ugandan government, financial, telecom and private sector web applications, APIs and internal tools, this is worth checking even where an organisation does not knowingly run it, as Node.js is often embedded in vendor software, developer tooling and container images. Administrators must identify all Node.js installations and upgrade to 22.23.4, 24.22.1 or 26.12.1 or later, and migrate any systems on end-of-life versions to a supported release. The advisory offers no temporary workaround for the Brotli flaw, so upgrading is the only complete fix. Systems running Node.js from Linux distribution packages (such as Debian, Alpine, Fedora and RHEL) may link a system Brotli library, so the fix has to arrive through the distribution’s own package updates, and checking the Node.js version number alone does not confirm they are patched. Other software that bundles Brotli may also need updating to Brotli 1.2.1, 1.1.1 or 1.0.10. Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions +10

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.